feat(claude-code): agent-integrity plugin (Agent Manifest + TRACE)

[imran-siddique]

What

A Claude Code integration that turns agentrust's own governance specs on the coding agent we use daily. Per session it captures:

• Agent Manifest — what the agent is: skills, tools, MCP servers, model, permission policy, instruction layer, each fingerprinted and Ed25519-signed.
• TRACE Trust Record — what the agent did this run, signed and conformance-checkable (Level 0, software-only).

and answers: is the agent I'm running the one I approved — nothing added, nothing subtracted?

How it works

• SessionStart hook is stdlib-only (no crypto deps, never blocks startup): snapshot from disk, diff against ~/.claude/agentrust/baseline.json, warn in-session on drift.
• /manifest verify|approve and /trace slash commands. Signing runs only on demand.
• observed-category diff: the disk-only hook compares skills/permissions/instruction-layer and never false-flags the live tool roster of a richer baseline (regression-tested).

Verification

• pytest tests/ — 6 passing (stdlib-only, no network/crypto).
• Emitted TRACE record passes trace-tests verify --level 0 (PASS 8/8).
• Manifest schema-validates and its Ed25519 signature re-verifies.
• integration.yaml validates against schema/integration.schema.json.
• Exercised on a real box: clean baseline, tamper (rogue skill / rogue MCP) correctly flagged.

Honest scope (see README "Known gaps")

Software-only Level 0 (no TEE on a dev box); the system_prompt fingerprint is a proxy over CLAUDE.md/memory; policy_language enum has no host-native value (modelled as composite, spec feedback to follow); agent-manifest 0.3.x targeted but PyPI is at 0.2.0.

Tier left as community (set by maintainers, not self-declared).

🤖 Generated with Claude Code